Buggy code:
public class EJBSecurityViewConfigurator implements ViewConfigurator { @ Override public void configure ( DeploymentPhaseContext context , ComponentConfiguration componentConfiguration , ViewDescription viewDescription , ViewConfiguration viewConfiguration ) throws DeploymentUnitProcessingException { if ( ( ( componentConfiguration . getComponentDescription ( ) ) instanceof EJBComponentDescription ) == false ) { throw ROOT_LOGGER . invalidEjbComponent ( componentConfiguration . getComponentName ( ) , componentConfiguration . getComponentClass ( ) ) ; } final DeploymentReflectionIndex deploymentReflectionIndex = context . getDeploymentUnit ( ) . getAttachment ( REFLECTION_INDEX ) ; final EJBComponentDescription ejbComponentDescription = ( ( EJBComponentDescription ) ( componentConfiguration . getComponentDescription ( ) ) ) ; if ( ( ( ejbComponentDescription . getSecurityDomain ( ) ) == null ) || ( ejbComponentDescription . getSecurityDomain ( ) . isEmpty ( ) ) ) { ROOT_LOGGER . debug ( ( ( "Security<seq2seq4repair_space>is<seq2seq4repair_space>*not*<seq2seq4repair_space>enabled<seq2seq4repair_space>on<seq2seq4repair_space>EJB:<seq2seq4repair_space>" + ( ejbComponentDescription . getEJBName ( ) ) ) + ",<seq2seq4repair_space>since<seq2seq4repair_space>no<seq2seq4repair_space>explicit<seq2seq4repair_space>security<seq2seq4repair_space>domain<seq2seq4repair_space>is<seq2seq4repair_space>configured<seq2seq4repair_space>for<seq2seq4repair_space>the<seq2seq4repair_space>bean,<seq2seq4repair_space>nor<seq2seq4repair_space>is<seq2seq4repair_space>there<seq2seq4repair_space>any<seq2seq4repair_space>default<seq2seq4repair_space>security<seq2seq4repair_space>domain<seq2seq4repair_space>configured<seq2seq4repair_space>in<seq2seq4repair_space>the<seq2seq4repair_space>EJB3<seq2seq4repair_space>subsystem" ) ) ; return ; } final String viewClassName = viewDescription . getViewClassName ( ) ; final EJBViewDescription ejbViewDescription = ( ( EJBViewDescription ) ( viewDescription ) ) ; DeploymentUnit deploymentUnit = context . getDeploymentUnit ( ) ; String contextID = deploymentUnit . getName ( ) ; if ( ( deploymentUnit . getParent ( ) ) != null ) { contextID = ( ( deploymentUnit . getParent ( ) . getName ( ) ) + "!" ) + contextID ; } final EJBViewMethodSecurityAttributesService . Builder viewMethodSecurityAttributesServiceBuilder ; final ServiceName viewMethodSecurityAttributesServiceName ; if ( ( ( ejbComponentDescription instanceof SessionBeanComponentDescription ) && ( ( MethodIntf . SERVICE_ENDPOINT ) == ( ejbViewDescription . getMethodIntf ( ) ) ) ) && ( ( ( SessionBeanComponentDescription ) ( ejbComponentDescription ) ) . hasNoInterfaceView ( ) ) ) { viewMethodSecurityAttributesServiceBuilder = null ; viewMethodSecurityAttributesServiceName = null ; } else { viewMethodSecurityAttributesServiceBuilder = new EJBViewMethodSecurityAttributesService . Builder ( viewClassName ) ; viewMethodSecurityAttributesServiceName = EJBViewMethodSecurityAttributesService . getServiceName ( ejbComponentDescription . getApplicationName ( ) , ejbComponentDescription . getModuleName ( ) , ejbComponentDescription . getEJBName ( ) , viewClassName ) ; } boolean beanHasMethodLevelSecurityMetadata = false ; final List < Method > viewMethods = viewConfiguration . getProxyFactory ( ) . getCachedMethods ( ) ; final List < Method > methodsWithoutExplicitSecurityConfiguration = new ArrayList < Method > ( ) ; for ( final Method viewMethod : viewMethods ) { if ( ! ( Modifier . isPublic ( viewMethod . getModifiers ( ) ) ) ) { continue ; } if ( ( viewMethod . getDeclaringClass ( ) ) == ( WriteReplaceInterface . class ) ) { continue ; } final ApplicableMethodInformation < EJBMethodSecurityAttribute > permissions = ejbComponentDescription . getDescriptorMethodPermissions ( ) ; boolean methodHasSecurityMetadata = handlePermissions ( contextID , componentConfiguration , viewConfiguration , deploymentReflectionIndex , viewClassName , ejbViewDescription , viewMethod , permissions , false , viewMethodSecurityAttributesServiceBuilder ) ; if ( ! methodHasSecurityMetadata ) { methodHasSecurityMetadata = handlePermissions ( contextID , componentConfiguration , viewConfiguration , deploymentReflectionIndex , viewClassName , ejbViewDescription , viewMethod , ejbComponentDescription . getAnnotationMethodPermissions ( ) , true , viewMethodSecurityAttributesServiceBuilder ) ; } if ( methodHasSecurityMetadata ) { beanHasMethodLevelSecurityMetadata = true ; } else { methodsWithoutExplicitSecurityConfiguration . add ( viewMethod ) ; } } final boolean securityRequired = beanHasMethodLevelSecurityMetadata || ( ejbComponentDescription . hasBeanLevelSecurityMetadata ( ) ) ; <START_BUG> viewConfiguration . addViewInterceptor ( new SecurityContextInterceptorFactory ( securityRequired , true , contextID ) , SECURITY_CONTEXT ) ; <END_BUG> if ( securityRequired ) { final Boolean denyAccessToMethodsMissingPermissions = ( ( EJBComponentDescription ) ( componentConfiguration . getComponentDescription ( ) ) ) . isMissingMethodPermissionsDeniedAccess ( ) ; if ( ( denyAccessToMethodsMissingPermissions == null ) || ( denyAccessToMethodsMissingPermissions == true ) ) { for ( final Method viewMethod : methodsWithoutExplicitSecurityConfiguration ) { if ( viewMethodSecurityAttributesServiceBuilder != null ) { viewMethodSecurityAttributesServiceBuilder . addMethodSecurityMetadata ( viewMethod , EJBMethodSecurityAttribute . denyAll ( ) ) ; } final Interceptor authorizationInterceptor = new AuthorizationInterceptor ( EJBMethodSecurityAttribute . denyAll ( ) , viewClassName , viewMethod , contextID ) ; viewConfiguration . addViewInterceptor ( viewMethod , new org . jboss . invocation . ImmediateInterceptorFactory ( authorizationInterceptor ) , EJB_SECURITY_AUTHORIZATION_INTERCEPTOR ) ; } } if ( viewMethodSecurityAttributesServiceBuilder != null ) { final EJBViewMethodSecurityAttributesService viewMethodSecurityAttributesService = viewMethodSecurityAttributesServiceBuilder . build ( ) ; context . getServiceTarget ( ) . addService ( viewMethodSecurityAttributesServiceName , viewMethodSecurityAttributesService ) . install ( ) ; } } else { ROOT_LOGGER . debug ( ( ( "Security<seq2seq4repair_space>is<seq2seq4repair_space>*not*<seq2seq4repair_space>enabled<seq2seq4repair_space>on<seq2seq4repair_space>EJB:<seq2seq4repair_space>" + ( ejbComponentDescription . getEJBName ( ) ) ) + ",<seq2seq4repair_space>no<seq2seq4repair_space>security<seq2seq4repair_space>interceptors<seq2seq4repair_space>will<seq2seq4repair_space>apply" ) ) ; if ( viewMethodSecurityAttributesServiceBuilder != null ) { final EJBViewMethodSecurityAttributesService viewMethodSecurityAttributesService = viewMethodSecurityAttributesServiceBuilder . build ( ) ; context . getServiceTarget ( ) . addService ( viewMethodSecurityAttributesServiceName , viewMethodSecurityAttributesService ) . install ( ) ; } return ; } } private boolean handlePermissions ( String contextID , ComponentConfiguration componentConfiguration , ViewConfiguration viewConfiguration , DeploymentReflectionIndex deploymentReflectionIndex , String viewClassName , EJBViewDescription ejbViewDescription , Method viewMethod , ApplicableMethodInformation < EJBMethodSecurityAttribute > permissions , boolean annotations , final EJBViewMethodSecurityAttributesService . Builder viewMethodSecurityAttributesServiceBuilder ) { } }

Fix:
viewConfiguration . addViewInterceptor ( new SecurityContextInterceptorFactory ( securityRequired ) , SECURITY_CONTEXT ) ;